Assuming something like TK-487 becomes available, use it in cli.services to trigger immediate shutdowns, when appropriate and remove the maintenance-mode workaround.